Your RSA-2048 keys break in 2030. Find every one of them before attackers do.

SBOM vs CBOM vs AIBOM vs QBOM vs HBOM

The Bill of Materials family — collectively “xBOM” — extends one idea across a system: a machine-readable inventory of what something is built from. SBOM covers software components; CBOM covers cryptography; AIBOM covers AI models and data; QBOM covers quantum-readiness; HBOM covers hardware. Each answers a different security and regulatory question, and increasingly you need several, not just one.

TypeInventoriesAnswersFormats
SBOM
Software Bill of Materials
Software components — direct and transitive dependencies, versions, suppliers, licenses.What software am I actually shipping?CycloneDX, SPDX
CBOM
Cryptographic Bill of Materials
Cryptographic assets — algorithms, key lengths, certificates, protocols, and where each is used.Where is my crypto, and is it quantum-vulnerable?CycloneDX (CBOM extension)
AIBOM
AI Bill of Materials
AI system components — models, training and fine-tuning datasets, weights, licenses, provenance.What is inside my AI system, and where did it come from?CycloneDX ML-BOM, SPDX 3.0
QBOM
Quantum Bill of Materials
Quantum-risk context over a CBOM — which crypto is vulnerable to a quantum computer, and the migration timeline.Am I ready for post-quantum, and by when must I migrate?Extends CBOM; aligned to NIST PQC / CNSA 2.0
HBOM
Hardware Bill of Materials
Physical and firmware components — chips, boards, embedded firmware, suppliers.What hardware and firmware is in my device?CycloneDX, CISA HBOM framework

SBOM vs CBOM

An SBOM inventories software components; a CBOM inventories cryptographic assets. A normal SBOM tells you a library uses “TLS,” but not which algorithms, key sizes, or certificates are actually in play — which is exactly what you need to plan a post-quantum migration. CBOM fills that gap and is the input to a QBOM.

CBOM guide

AIBOM vs SBOM

A standard SBOM captures the software libraries around a model but misses the model and data supply chain — the weights, the training and fine-tuning datasets, and their licenses and provenance. That is where AI-specific risk lives (poisoned data, unlicensed weights, unknown model origin), and it is what an AIBOM adds on top of the SBOM.

AIBOM guide

QBOM vs CBOM

A CBOM is the inventory: where your cryptography lives. A QBOM turns that inventory into a plan by adding quantum-risk context — which of those cryptographic assets are vulnerable to a quantum computer (RSA, ECC) and the estimated timeline — so you can prioritise a post-quantum migration against NIST PQC and CNSA 2.0 deadlines.

QBOM guide

Frequently asked questions

What is the difference between SBOM, CBOM, AIBOM, QBOM and HBOM?
They are members of the “xBOM” family, each a machine-readable inventory of a different layer. SBOM covers software components; CBOM covers cryptographic assets; AIBOM covers AI models and training data; QBOM adds quantum-risk context over a CBOM; HBOM covers physical hardware and firmware. Each answers a distinct security and regulatory question.
What is xBOM?
xBOM is the umbrella term for the whole Bill of Materials family — SBOM, CBOM, AIBOM, QBOM, HBOM. It reflects that a single software SBOM is no longer enough: modern systems also need visibility into cryptography, AI components, quantum readiness, and hardware.
Do I need more than an SBOM?
Increasingly, yes. An SBOM answers “what software am I shipping,” but it cannot tell you which cryptography is quantum-vulnerable (CBOM/QBOM), what is inside your AI systems (AIBOM), or what hardware and firmware you depend on (HBOM). Regulations such as CERT-In v2.0 in India already treat the bill of materials as a family, not a single artifact.
What is the difference between AIBOM and SBOM?
An SBOM inventories software libraries and their dependencies. An AIBOM adds the AI-specific supply chain a normal SBOM misses: the models, weights, and training/fine-tuning datasets, plus their licenses and provenance — where AI risk like data poisoning and unlicensed weights actually sits.
What is the difference between CBOM and QBOM?
A CBOM is the inventory of your cryptographic assets — algorithms, keys, certificates, and where they are used. A QBOM extends it with quantum-risk context: which of those assets are vulnerable to a quantum computer and the timeline for that risk, turning the inventory into a prioritised post-quantum migration plan.

See your full attack chain.
Code, build, runtime. One platform.